@shipfox/api-integration-core 2.0.0

package/src/presentation/routes/agent-tools-gateway/index.ts

@@ -0,0 +1,62 @@
+import {StreamableHTTPServerTransport} from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import type {Transport} from '@modelcontextprotocol/sdk/shared/transport.js';
+import {AUTH_LEASED_JOB, requireLeasedJobContext} from '@shipfox/api-auth-context';
+import {defineRoute, type RouteGroup} from '@shipfox/node-fastify';
+import type {IntegrationProviderRegistry} from '#core/providers/registry.js';
+import type {GetIntegrationConnectionByIdFn} from '#db/connections.js';
+import {createIntegrationToolCallRecorder} from './audit.js';
+import {createIntegrationToolDispatcher} from './dispatch.js';
+import {buildAgentToolsMcpServer} from './mcp-server.js';
+import {
+  type LeasedAgentStepLoader,
+  resolveAuthorizedIntegrationTools,
+} from './resolve-authorized-tools.js';
+
+export type {LeasedAgentStepLoader} from './resolve-authorized-tools.js';
+
+export interface CreateAgentToolsGatewayRoutesParams {
+  loadLeasedAgentStep: LeasedAgentStepLoader;
+  registry: IntegrationProviderRegistry;
+  getIntegrationConnectionById: GetIntegrationConnectionByIdFn;
+}
+
+export function createAgentToolsGatewayRoutes(
+  params: CreateAgentToolsGatewayRoutesParams,
+): RouteGroup {
+  const dispatchIntegrationToolCall = createIntegrationToolDispatcher({registry: params.registry});
+
+  return {
+    prefix: '/runs/jobs/current/integration-tools',
+    auth: AUTH_LEASED_JOB,
+    routes: [
+      defineRoute({
+        method: 'POST',
+        path: '/mcp',
+        description: 'Gateway MCP endpoint for integration-backed agent tools',
+        handler: async (request, reply) => {
+          const authorizedTools = await resolveAuthorizedIntegrationTools({
+            request,
+            loadLeasedAgentStep: params.loadLeasedAgentStep,
+            registry: params.registry,
+            getIntegrationConnectionById: params.getIntegrationConnectionById,
+          });
+          const server = buildAgentToolsMcpServer({
+            authorizedTools,
+            dispatch: dispatchIntegrationToolCall,
+            recordCall: createIntegrationToolCallRecorder(requireLeasedJobContext(request)),
+          });
+          const transport = new StreamableHTTPServerTransport();
+
+          await server.connect(transport as unknown as Transport);
+          reply.raw.on('close', () => {
+            void transport.close();
+            void server.close();
+          });
+
+          reply.hijack();
+          await transport.handleRequest(request.raw, reply.raw, request.body);
+        },
+      }),
+    ],
+  };
+}

package/src/presentation/routes/agent-tools-gateway/mcp-server.test.ts

@@ -0,0 +1,308 @@
+import {Client} from '@modelcontextprotocol/sdk/client/index.js';
+import {InMemoryTransport} from '@modelcontextprotocol/sdk/inMemory.js';
+import {CallToolResultSchema} from '@modelcontextprotocol/sdk/types.js';
+import {
+  catalogTool,
+  connection,
+  materializedIntegration,
+  materializedTool,
+} from '#test/agent-tools-gateway-helpers.js';
+import {INVALID_METHOD_LABEL, NO_METHOD_LABEL} from './audit.js';
+import {buildAgentToolsMcpServer, type IntegrationToolDispatchInput} from './mcp-server.js';
+import type {AuthorizedIntegrationToolMap} from './resolve-authorized-tools.js';
+
+describe('buildAgentToolsMcpServer', () => {
+  it('lists namespaced tools and dispatches authorized method-family calls', async () => {
+    const dispatch = vi.fn(async (input: IntegrationToolDispatchInput) => ({
+      content: [{type: 'text' as const, text: `called:${input.method}`}],
+    }));
+    const records: Parameters<
+      NonNullable<Parameters<typeof buildAgentToolsMcpServer>[0]['recordCall']>
+    >[0][] = [];
+    const {client, close} = await connectClient(dispatch, defaultAuthorizedTools(), (record) =>
+      records.push(record),
+    );
+
+    const tools = await client.listTools();
+    const result = await client.callTool(
+      {
+        name: 'github_main__issue_read',
+        arguments: {method: 'get', owner: 'shipfox', repo: 'platform', issue_number: 1},
+      },
+      CallToolResultSchema,
+    );
+    await close();
+
+    expect(tools.tools).toMatchObject([
+      {
+        name: 'github_main__issue_read',
+        description: 'Read issue metadata from GitHub.',
+      },
+    ]);
+    expect(result.isError).not.toBe(true);
+    expect(dispatch).toHaveBeenCalledWith(
+      expect.objectContaining({
+        method: 'get',
+        arguments: expect.objectContaining({issue_number: 1}),
+      }),
+    );
+    expect(records).toMatchObject([
+      {
+        authorizedTool: expect.objectContaining({
+          integration: expect.objectContaining({provider: 'github'}),
+          tool: expect.objectContaining({id: 'issue_read'}),
+        }),
+        method: 'get',
+        outcome: 'success',
+      },
+    ]);
+  });
+
+  it.each([
+    ['unknown tool', 'missing__tool', {method: 'get'}, NO_METHOD_LABEL, undefined],
+    ['missing method', 'github_main__issue_read', {}, INVALID_METHOD_LABEL, 'issue_read'],
+    [
+      'non-string method',
+      'github_main__issue_read',
+      {method: 1},
+      INVALID_METHOD_LABEL,
+      'issue_read',
+    ],
+    [
+      'unauthorized method',
+      'github_main__issue_read',
+      {method: 'get_labels'},
+      INVALID_METHOD_LABEL,
+      'issue_read',
+    ],
+  ])('returns an isError tool result and records invalid-request for %s', async (_label, name, args, expectedMethod, expectedToolId) => {
+    const dispatch = vi.fn();
+    const records: Parameters<
+      NonNullable<Parameters<typeof buildAgentToolsMcpServer>[0]['recordCall']>
+    >[0][] = [];
+    const {client, close} = await connectClient(dispatch, defaultAuthorizedTools(), (record) =>
+      records.push(record),
+    );
+
+    const result = await client.callTool({name, arguments: args}, CallToolResultSchema);
+    await close();
+
+    expect(result.isError).toBe(true);
+    expect(dispatch).not.toHaveBeenCalled();
+    expect(records).toMatchObject([
+      {
+        method: expectedMethod,
+        outcome: 'invalid-request',
+      },
+    ]);
+    if (expectedToolId) {
+      expect(records[0]?.authorizedTool).toEqual(
+        expect.objectContaining({tool: expect.objectContaining({id: expectedToolId})}),
+      );
+    } else {
+      expect(records[0]?.authorizedTool).toBeUndefined();
+    }
+  });
+
+  it('ignores a stray method argument for standalone tools', async () => {
+    const dispatch = vi.fn(async () => ({
+      content: [{type: 'text' as const, text: 'called'}],
+    }));
+    const records: Parameters<
+      NonNullable<Parameters<typeof buildAgentToolsMcpServer>[0]['recordCall']>
+    >[0][] = [];
+    const {client, close} = await connectClient(dispatch, standaloneTools(), (record) =>
+      records.push(record),
+    );
+
+    const result = await client.callTool(
+      {name: 'github_main__list_issues', arguments: {method: 'ignored'}},
+      CallToolResultSchema,
+    );
+    await close();
+
+    expect(result.isError).not.toBe(true);
+    expect(dispatch).toHaveBeenCalledWith(
+      expect.objectContaining({
+        method: undefined,
+        arguments: {method: 'ignored'},
+      }),
+    );
+    expect(records).toMatchObject([{method: NO_METHOD_LABEL, outcome: 'success'}]);
+  });
+
+  it('defaults omitted arguments to an empty object for optional-argument tools', async () => {
+    const dispatch = vi.fn(async () => ({
+      content: [{type: 'text' as const, text: 'called'}],
+    }));
+    const {client, close} = await connectClient(dispatch, standaloneTools());
+
+    const result = await client.callTool({name: 'github_main__list_issues'}, CallToolResultSchema);
+    await close();
+
+    expect(result.isError).not.toBe(true);
+    expect(dispatch).toHaveBeenCalledWith(
+      expect.objectContaining({
+        arguments: {},
+      }),
+    );
+  });
+
+  it('leaves provider argument validation to the selected provider', async () => {
+    const dispatch = vi.fn(async () => ({
+      content: [{type: 'text' as const, text: 'called'}],
+    }));
+    const records: Parameters<
+      NonNullable<Parameters<typeof buildAgentToolsMcpServer>[0]['recordCall']>
+    >[0][] = [];
+    const {client, close} = await connectClient(dispatch, defaultAuthorizedTools(), (record) =>
+      records.push(record),
+    );
+
+    const result = await client.callTool(
+      {
+        name: 'github_main__issue_read',
+        arguments: {
+          method: 'get',
+          owner: 'shipfox',
+          repo: 'platform',
+          issue_number: 'not-an-integer',
+        },
+      },
+      CallToolResultSchema,
+    );
+    await close();
+
+    expect(result.isError).not.toBe(true);
+    expect(dispatch).toHaveBeenCalledWith(
+      expect.objectContaining({
+        arguments: expect.objectContaining({issue_number: 'not-an-integer'}),
+      }),
+    );
+    expect(records).toMatchObject([{method: 'get', outcome: 'success'}]);
+  });
+
+  it('records tool-error when dispatch returns an error result', async () => {
+    const dispatch = vi.fn(async () => ({
+      isError: true,
+      content: [{type: 'text' as const, text: 'provider rejected call'}],
+    }));
+    const records: Parameters<
+      NonNullable<Parameters<typeof buildAgentToolsMcpServer>[0]['recordCall']>
+    >[0][] = [];
+    const {client, close} = await connectClient(dispatch, defaultAuthorizedTools(), (record) =>
+      records.push(record),
+    );
+
+    const result = await client.callTool(
+      {
+        name: 'github_main__issue_read',
+        arguments: {method: 'get', owner: 'shipfox', repo: 'platform', issue_number: 1},
+      },
+      CallToolResultSchema,
+    );
+    await close();
+
+    expect(result.isError).toBe(true);
+    expect(records).toMatchObject([{method: 'get', outcome: 'tool-error'}]);
+  });
+
+  it('records exception before rethrowing dispatcher failures', async () => {
+    const dispatch = vi.fn(() => Promise.reject(new Error('provider unavailable')));
+    const records: Parameters<
+      NonNullable<Parameters<typeof buildAgentToolsMcpServer>[0]['recordCall']>
+    >[0][] = [];
+    const {client, close} = await connectClient(dispatch, defaultAuthorizedTools(), (record) =>
+      records.push(record),
+    );
+
+    await expect(
+      client.callTool(
+        {
+          name: 'github_main__issue_read',
+          arguments: {method: 'get', owner: 'shipfox', repo: 'platform', issue_number: 1},
+        },
+        CallToolResultSchema,
+      ),
+    ).rejects.toThrow('MCP error -32603');
+    await close();
+
+    expect(records).toMatchObject([{method: 'get', outcome: 'exception'}]);
+  });
+});
+
+async function connectClient(
+  dispatch: Parameters<typeof buildAgentToolsMcpServer>[0]['dispatch'],
+  authorizedTools = defaultAuthorizedTools(),
+  recordCall?: Parameters<typeof buildAgentToolsMcpServer>[0]['recordCall'],
+) {
+  const server = buildAgentToolsMcpServer({authorizedTools, dispatch, recordCall});
+  const client = new Client({name: 'test-client', version: '0.0.0'});
+  const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+
+  await server.connect(serverTransport);
+  await client.connect(clientTransport);
+
+  return {
+    client,
+    close: async () => {
+      await client.close();
+      await server.close();
+    },
+  };
+}
+
+function defaultAuthorizedTools(): AuthorizedIntegrationToolMap {
+  const integration = materializedIntegration({connectionId: 'connection-1'});
+  const tool = materializedTool();
+  return new Map([
+    [
+      'github_main__issue_read',
+      {
+        mcpName: 'github_main__issue_read',
+        integration,
+        tool,
+        connection: connection({
+          id: 'connection-1',
+          workspaceId: 'workspace-1',
+          slug: integration.connectionSlug,
+        }),
+        description: catalogTool().description,
+        inputSchema: tool.inputSchema,
+      },
+    ],
+  ]);
+}
+
+function standaloneTools(): AuthorizedIntegrationToolMap {
+  const integration = materializedIntegration({
+    connectionId: 'connection-1',
+    tools: [
+      materializedTool({
+        id: 'list_issues',
+        methods: undefined,
+        inputSchema: {type: 'object', properties: {}, additionalProperties: true},
+      }),
+    ],
+  });
+  const [tool] = integration.tools;
+  if (!tool) throw new Error('Expected standalone integration tool');
+
+  return new Map([
+    [
+      'github_main__list_issues',
+      {
+        mcpName: 'github_main__list_issues',
+        integration,
+        tool,
+        connection: connection({
+          id: 'connection-1',
+          workspaceId: 'workspace-1',
+          slug: integration.connectionSlug,
+        }),
+        description: 'List issues',
+        inputSchema: tool.inputSchema,
+      },
+    ],
+  ]);
+}

package/src/presentation/routes/agent-tools-gateway/mcp-server.ts

@@ -0,0 +1,155 @@
+import {Server} from '@modelcontextprotocol/sdk/server/index.js';
+import {
+  CallToolRequestSchema,
+  type CallToolResult,
+  ListToolsRequestSchema,
+} from '@modelcontextprotocol/sdk/types.js';
+import {INVALID_METHOD_LABEL, type IntegrationToolCallRecorder, NO_METHOD_LABEL} from './audit.js';
+import type {
+  AuthorizedIntegrationTool,
+  AuthorizedIntegrationToolMap,
+} from './resolve-authorized-tools.js';
+
+export interface IntegrationToolDispatchInput {
+  authorizedTool: AuthorizedIntegrationTool;
+  arguments: Record<string, unknown>;
+  method?: string | undefined;
+}
+
+export type IntegrationToolDispatcher = (
+  input: IntegrationToolDispatchInput,
+) => Promise<CallToolResult>;
+
+export interface BuildAgentToolsMcpServerParams {
+  authorizedTools: AuthorizedIntegrationToolMap;
+  dispatch: IntegrationToolDispatcher;
+  recordCall?: IntegrationToolCallRecorder | undefined;
+}
+
+export function buildAgentToolsMcpServer(params: BuildAgentToolsMcpServerParams): Server {
+  const server = new Server(
+    {name: 'shipfox-integration-tools', version: '0.0.0'},
+    {capabilities: {tools: {}}},
+  );
+  server.setRequestHandler(ListToolsRequestSchema, () => ({
+    tools: [...params.authorizedTools.values()].map((authorizedTool) => ({
+      name: authorizedTool.mcpName,
+      description: authorizedTool.description,
+      inputSchema: authorizedTool.inputSchema as {
+        type: 'object';
+        properties?: Record<string, object> | undefined;
+        required?: string[] | undefined;
+      },
+      ...(authorizedTool.outputSchema
+        ? {
+            outputSchema: authorizedTool.outputSchema as {
+              type: 'object';
+              properties?: Record<string, object> | undefined;
+              required?: string[] | undefined;
+            },
+          }
+        : {}),
+    })),
+  }));
+
+  server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const authorizedTool = params.authorizedTools.get(request.params.name);
+    if (!authorizedTool) {
+      recordToolCall(params.recordCall, {
+        arguments: request.params.arguments ?? {},
+        method: NO_METHOD_LABEL,
+        outcome: 'invalid-request',
+      });
+      return toolError(`Unknown integration tool: ${request.params.name}`);
+    }
+
+    const args = request.params.arguments ?? {};
+    if (!isRecord(args)) {
+      recordToolCall(params.recordCall, {
+        authorizedTool,
+        arguments: args,
+        method: NO_METHOD_LABEL,
+        outcome: 'invalid-request',
+      });
+      return toolError('Tool arguments must be an object');
+    }
+
+    const methodValidation = validateMethod(authorizedTool, args);
+    if (methodValidation.kind === 'error') {
+      recordToolCall(params.recordCall, {
+        authorizedTool,
+        arguments: args,
+        method: INVALID_METHOD_LABEL,
+        outcome: 'invalid-request',
+      });
+      return toolError(methodValidation.message);
+    }
+    const method = methodValidation.method ?? NO_METHOD_LABEL;
+
+    try {
+      const result = await params.dispatch({
+        authorizedTool,
+        arguments: args,
+        method: methodValidation.method,
+      });
+      recordToolCall(params.recordCall, {
+        authorizedTool,
+        arguments: args,
+        method,
+        outcome: result.isError === true ? 'tool-error' : 'success',
+      });
+      return result;
+    } catch (error) {
+      recordToolCall(params.recordCall, {
+        authorizedTool,
+        arguments: args,
+        method,
+        outcome: 'exception',
+      });
+      throw error;
+    }
+  });
+
+  return server;
+}
+
+function recordToolCall(
+  recordCall: IntegrationToolCallRecorder | undefined,
+  record: Parameters<IntegrationToolCallRecorder>[0],
+): void {
+  try {
+    recordCall?.(record);
+  } catch {
+    // Audit and metrics must not affect MCP responses.
+  }
+}
+
+function validateMethod(
+  authorizedTool: AuthorizedIntegrationTool,
+  args: Record<string, unknown>,
+): {kind: 'ok'; method?: string | undefined} | {kind: 'error'; message: string} {
+  if (!authorizedTool.tool.methods) return {kind: 'ok'};
+
+  const method = args.method;
+  if (typeof method !== 'string') {
+    return {kind: 'error', message: 'Method-family tools require a string method argument'};
+  }
+
+  const allowedMethods = new Set(authorizedTool.tool.methods.map((candidate) => candidate.id));
+  if (!allowedMethods.has(method)) {
+    return {kind: 'error', message: `Unauthorized integration tool method: ${method}`};
+  }
+
+  return {kind: 'ok', method};
+}
+
+function toolError(message: string): CallToolResult {
+  return {
+    isError: true,
+    content: [{type: 'text', text: message}],
+  };
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}

package/src/presentation/routes/agent-tools-gateway/resolve-authorized-tools.test.ts

@@ -0,0 +1,181 @@
+import {setLeasedJobContext} from '@shipfox/api-auth-context';
+import {createIntegrationProviderRegistry} from '#core/providers/registry.js';
+import {
+  agentStepConfig,
+  catalogTool,
+  connection,
+  leaseContext,
+  materializedIntegration,
+  registryWithAgentTools,
+} from '#test/agent-tools-gateway-helpers.js';
+import {
+  mcpToolName,
+  narrowMethodEnum,
+  resolveAuthorizedIntegrationTools,
+  sanitizeSlug,
+} from './resolve-authorized-tools.js';
+
+describe('resolveAuthorizedIntegrationTools', () => {
+  it('resolves namespaced tools with live descriptions and Anthropic-compatible method schemas', async () => {
+    const request = {};
+    const lease = leaseContext();
+    const integration = materializedIntegration({connectionId: 'connection-1'});
+    setLeasedJobContext(request, lease);
+
+    const result = await resolveAuthorizedIntegrationTools({
+      request,
+      registry: registryWithAgentTools([catalogTool({description: 'Live issue reader'})]),
+      getIntegrationConnectionById: async () =>
+        connection({
+          id: 'connection-1',
+          workspaceId: lease.workspaceId,
+          slug: integration.connectionSlug,
+        }),
+      loadLeasedAgentStep: async () => ({
+        workspaceId: lease.workspaceId,
+        step: {type: 'agent', config: agentStepConfig([integration])},
+      }),
+    });
+
+    const authorizedTool = result.get('github_main__issue_read');
+    expect(authorizedTool?.description).toBe('Live issue reader');
+    const properties = authorizedTool?.inputSchema.properties as Record<string, unknown>;
+    expect(properties.method).toMatchObject({
+      enum: ['get', 'get_comments'],
+    });
+    expect(authorizedTool?.inputSchema.oneOf).toBeUndefined();
+  });
+
+  it('fails closed when the lease has no current step', async () => {
+    const request = {};
+    setLeasedJobContext(
+      request,
+      leaseContext({currentStepId: undefined, currentStepAttempt: undefined}),
+    );
+
+    const act = resolveAuthorizedIntegrationTools({
+      request,
+      registry: registryWithAgentTools(),
+      getIntegrationConnectionById: async () => undefined,
+      loadLeasedAgentStep: () => Promise.reject(new Error('should not load')),
+    });
+
+    await expect(act).rejects.toMatchObject({code: 'lease-missing-step', status: 409});
+  });
+
+  it('fails closed when the current step is not an agent step', async () => {
+    const request = {};
+    const lease = leaseContext();
+    setLeasedJobContext(request, lease);
+
+    const act = resolveAuthorizedIntegrationTools({
+      request,
+      registry: registryWithAgentTools(),
+      getIntegrationConnectionById: async () => undefined,
+      loadLeasedAgentStep: async () => ({
+        workspaceId: lease.workspaceId,
+        step: {type: 'run', config: {}},
+      }),
+    });
+
+    await expect(act).rejects.toMatchObject({code: 'leased-step-not-agent', status: 409});
+  });
+
+  it.each([
+    ['deleted', undefined],
+    ['inactive', connection({id: 'connection-1', lifecycleStatus: 'disabled'})],
+    ['workspace mismatch', connection({id: 'connection-1', workspaceId: 'other-workspace'})],
+  ])('denies when the connection is %s', async (_label, resolvedConnection) => {
+    const request = {};
+    const lease = leaseContext({workspaceId: 'workspace-1'});
+    const integration = materializedIntegration({connectionId: 'connection-1'});
+    setLeasedJobContext(request, lease);
+
+    const act = resolveAuthorizedIntegrationTools({
+      request,
+      registry: registryWithAgentTools(),
+      getIntegrationConnectionById: async () => resolvedConnection,
+      loadLeasedAgentStep: async () => ({
+        workspaceId: lease.workspaceId,
+        step: {type: 'agent', config: agentStepConfig([integration])},
+      }),
+    });
+
+    await expect(act).rejects.toMatchObject({
+      code: 'integration-tool-connection-unavailable',
+      status: 409,
+    });
+  });
+
+  it('denies when the provider no longer exposes agent tools', async () => {
+    const request = {};
+    const lease = leaseContext({workspaceId: 'workspace-1'});
+    const integration = materializedIntegration({connectionId: 'connection-1'});
+    setLeasedJobContext(request, lease);
+
+    const act = resolveAuthorizedIntegrationTools({
+      request,
+      registry: createIntegrationProviderRegistry([{provider: 'github', displayName: 'GitHub'}]),
+      getIntegrationConnectionById: async () =>
+        connection({id: 'connection-1', workspaceId: lease.workspaceId}),
+      loadLeasedAgentStep: async () => ({
+        workspaceId: lease.workspaceId,
+        step: {type: 'agent', config: agentStepConfig([integration])},
+      }),
+    });
+
+    await expect(act).rejects.toMatchObject({
+      code: 'integration-tool-connection-unavailable',
+      status: 409,
+    });
+  });
+
+  it('detects MCP name collisions after slug sanitization', async () => {
+    const request = {};
+    const lease = leaseContext({workspaceId: 'workspace-1'});
+    const first = materializedIntegration({
+      connectionId: 'connection-1',
+      connectionSlug: 'github-main',
+    });
+    const second = materializedIntegration({
+      connectionId: 'connection-2',
+      connectionSlug: 'github_main',
+    });
+    setLeasedJobContext(request, lease);
+
+    const act = resolveAuthorizedIntegrationTools({
+      request,
+      registry: registryWithAgentTools(),
+      getIntegrationConnectionById: async (id) =>
+        connection({
+          id,
+          workspaceId: lease.workspaceId,
+          slug: id === 'connection-1' ? 'github-main' : 'github_main',
+        }),
+      loadLeasedAgentStep: async () => ({
+        workspaceId: lease.workspaceId,
+        step: {type: 'agent', config: agentStepConfig([first, second])},
+      }),
+    });
+
+    await expect(act).rejects.toMatchObject({
+      code: 'integration-tool-name-collision',
+      status: 409,
+    });
+  });
+
+  it('leaves unknown method schema shapes intact while runtime enforcement remains separate', () => {
+    const schema = {type: 'object', properties: {method: {type: 'string'}}};
+
+    const narrowed = narrowMethodEnum(schema, ['allowed']);
+
+    expect(narrowed).toEqual(schema);
+  });
+});
+
+describe('MCP tool names', () => {
+  it('sanitizes connection slugs without parsing names back apart', () => {
+    expect(sanitizeSlug('github-main')).toBe('github_main');
+    expect(mcpToolName('github-main', 'issue_read')).toBe('github_main__issue_read');
+  });
+});